Exit CCFH-202 CrowdStrike Certified Falcon Hunter
Question 2 of 5
0% complete
Q2 Single choice

Which field should you reference in order to find the system time of a *FileWritten event?

  • A

    ContextTimeStamp_decimal

  • B

    FileTimeStamp_decimal

  • C

    ProcessStartTime_decimal

  • D

    timestamp

Previous Next